iPhones Secretly Send Call History To Apple, Security Firm Says (theintercept.com)

Russian digital forensics Elcomsoft says iPhones send near real-time logs to Apple servers even when iCloud backup is switched off. The firm adds that these logs are stored for up to four months. From a report on the Intercept:"You only need to have iCloud itself enabled" for the data to be sent, said Vladimir Katalov, CEO of Elcomsoft. The logs surreptitiously uploaded to Apple contain a list of all calls made and received on an iOS device, complete with phone numbers, dates and times, and duration. They also include missed and bypassed calls. Elcomsoft said Apple retains the data in a user's iCloud account for up to four months, providing a boon to law enforcement who may not be able to obtain the data either from the user's carrier, who may retain the data for only a short period, or from the user's device, if it's encrypted with an unbreakable passcode. "Absolutely this is an advantage [for law enforcement]," Robert Osgood, a former FBI supervisory agent who now directs a graduate program in computer forensics at George Mason University, said of Apple's call-history uploads. "Four months is a long time [to retain call logs]. It's generally 30 or 60 days for telecom providers, because they don't want to keep more [records] than they absolutely have to. So if Apple is holding data for four months, that could be a very interesting data repository and they may have data that the telecom provider might not."

Comments

Yeah, and?

[squiggleslash]

I'm struggling to be outraged. iCloud stores a lot of stuff that's more personal than your call history, and for all Apple's faults, they've proven to be fairly strong on the privacy front.

(Also I'm still a little pissed that my BLU smartphone has been sending my SMS messages to China until today for reasons that nobody is willing to give an even vaguely plausible answer to.)

I'm not pro-Apple (see previous comments) but this isn't unexpected, secret, behavior. When you link your iDevice to something supposedly intended to keep it sync'd and backed up, this is exactly what you'd expect it to do. This isn't even a bug.

Re:Yeah, and?

[squiggleslash]

Apple is storing the call data without the user's knowledge or ability to control it.

I disagree on all points.

The user can control it, they can choose whether to link their device to iCloud or not. And saying it's "without the user's knowledge" is rather like saying "It stores the user's phonebook without their knowledge" or "It stores the user's photos without their knowledge". Sure, it may or may not explicitly state that, but it's implied by the very act of syncing.

This is, at best, a user pig-ignorance thing: by pig ignorance, I mean not merely that the user is ignorant, which is OK, it happens, not everyone's a tech expert, but one where a user hasn't even bothered to think about what enabling a particular feature on their phone means.

Re:Yeah, and?

[MachineShedFred]

Without the user's knowledge?

So when they get a new device and the call history magically shows up after putting in the iCloud account and password, it's divining that through psychic feed or something?

No ability to control it?

Turn off iCloud. It no longer stores this information. Sounds like a fairly easy and basic control to me. Would it be better if there was an individual switch for this function? Probably, but at some point you end up with an overwhelming page of little switches for every single little thing, and it's a usability nightmare that most people wouldn't bother with anyway.

Re:30 or 60 days

[stealth_finger]

I'm sorry but the people selling you phone service keeping logs of your phone calls is one thing, the people that just made the phone have no business at all logging that data for any reason. But I guess it's ok though because apple did it and apple can do no wrong.

Re:very interesting indeed

[Anubis IV]

And that's a fair point. Apple already does quite a bit to try and educate their users about the security and privacy of their devices, but the industry as a whole needs to be doing an even better job, as I'm sure you'd agree.

Even so, the details were readily available to anyone who was interested in them, and Apple's white papers are fairly easy reading as far as technical breakdowns go, so the headline's claim that Apple was secretly collecting the data is clearly false, which is highlighted by the fact that the article itself refutes the headline.